Advanced Persistent Response - Pwn2Own › csw12 › CSW2012-AdvPersistent... · Advanced...

P l Uhl | Pl tf S it St t i tAdvanced Persistent ResponsePeleus Uhley | Platform Security Strategist

Outline

Background Analyzing threatAnalyzing threat Finding resources

Planning a response Planning a response Tool release Conclusion

Advanced Persistent Threat

“usually refers to a group with both the capability and the intent to persistently and p y p yeffectively target a specific entity”- Wikipedia- Wikipedia

Flash Player 0-days

4 SWF in PDF attacks

3 XSS attacks

4 SWF in Office document attacks

Flash Player 0-days – Alternative measurement

Advanced Persistent Response

The strategy necessary to inhibit or reduce a malicious entity or entities’ capabilities to y prepeatedly conduct attacks leveraging a specific platform or against a specific target.p p g p g

Information Gathering

Know your adversary

Who are they? Why are they upset?Why are they upset? Does it change over time?

CVE-2011-0609

CVE-2011-0611

yuange1975

Beware of false positives

Technical Analysis

Their sources? Their targets?Their targets? Their skill?

Data Source Analysis

Series of attacks based on SWFs from flashandmath.com

Indicates the areas of code that are being attacked Learn from mimicking their approachLearn from mimicking their approach

Targets

Reports from government customers

Document-based spearDocument based spear phishing attacks

Most exploits are never widely deployedwidely deployed

Payload Analysis

Symantec studied payloads from 2006 -> 2011

Attacks grouped based on the malware installed (Sykipot)(Sykipot)

L d & t l b t t Large command & control botnet

Mostly used zero-day attacks within several different products to install

Sykipot

“Thus, the Sykipot attackers are likely to be an organized and skilled group of individuals. g g pGiven their persistence and their long-running campaigns, the attackers are likely to have p g , yconsistent funding for their efforts.”

- Symantec Blog, December 08, 2011

Changes in the field

A change in targets will require changes to security feature strategy

Exploit kits recently started using SWFs.Exploit kits recently started using SWFs.

E l it kit tt k th t t l t 2 th Exploit kits use attacks that are at least 2 months old

Effect of exploit kits

Everything is relative

Evolution of attacks

Attackers gain skill with practice

Hackers will utilize published research

Makes signature development more difficult

CVE-2009-1862

Simple bit flip of existing SWF from the web A second SWF was used for the heap sprayA second SWF was used for the heap spray Both SWFs were inside a PDF

Flash was a means to an end Flash was a means to an end

2010 Improvements

Eventually moved to a single file approach

Parent SWF

Initialization& Heap Spray

Crashing Child SWFCrashing Child SWF

Trying new research

CVE-2011-2110

Dynamically passing obfuscated data

main.swf?info=02E6B1525353CAA8AD555555AD31B3D73034B657AA31B4B5AFB5B2B537AF55543549AEB550AC55303736B337AF51D35271B4B5AFB5B2B537AF55543549AEB550AC55303736B337AF51D3527B7AF4C66B7E

Targeting specific versions

if ((((((Capabilities.version.toLowerCase() == "win 10,3,181,14")) || ((Capabilities version toLowerCase() == "win 10 3 181 22")))) ||((Capabilities.version.toLowerCase() == win 10,3,181,22 )))) || ((Capabilities.version.toLowerCase() == "win 10,3,181,23")))){

Return orientated programming

Conversion to logic based attacks

CVE-2011-2107, CVE-2011-2444 & CVE-2012-0757 were XSS attacks

Required ActionScript programming knowledge Trial & error methods used to identify vulnerabilitiesTrial & error methods used to identify vulnerabilities

Overall Advancements

• Dumb fuzzing

2009 • Brute force memory tricks

2010• Modularizing code• Experimenting with research techniques

• Full language understanding• ROP exploitation

2011ROP exploitation

• Bypassing mitigation strategies

Resourcing a response plan

All you need is…

More time More moneyMore money More hardware

More people More people More…

Balancing the load

Security teams should focus on larger, high value projects

Any developer should be able to fix a software crash

Training

Minimum security training level for everyone

Everyone within the Flash Runtime team has at least a white belt security certificationleast a white belt security certification

B b lt j t ll th ti Brown belt projects allow the entirecompany to assist!

Adobe training results

60Zero Day Response Over Time

Zero Day Response Over

2008 2009 2010 2011

Make friends!

“It is easy enough to be friendly to one's friends. But to befriend the one who regards himself as your enemy is the quintessence of true religion The other is merereligion. The other is mere business.”

― Mahatma Gandhi

Types of friends

Researchers Business partnersBusiness partners Defensive software companies

Victims of attacks Victims of attacks Tool vendors

Planning a response strategy

Secure Product Lifecycle?

1. Increase the difficultly of exploitation.y p

2. Limit the window of opportunity for use.

Killing bugs

Fuzzing at scale

Partnered with Google on FP fuzzing effort 2,000 CPUs2,000 CPUs Corpus distillation of 2 TB of SWFs into 20,000 files

(1 week)(1 week) 3 weeks of fuzzing

Bit fli i h Bit flipping approach 1 fuzzing guru (Tavis Ormandy)

“Patching at scale”

400 files distilled into 80 unique issues Used fuzzers to reproduce and classify issuesUsed fuzzers to reproduce and classify issues Authored app to auto-file bugs

Created tiger team to address the issues Created tiger team to address the issues Majority of issues addressed within 60 days

Fuzzing results

!exploitable

ExploitableProbably ExploitableUnknownProbably Not Exploitable

Alternative measurement

“This is completely unfair competition and unfair practices vis-a-vis other securityunfair practices vis a vis other security researchers (or fuzzer enthus). …You guyz killed couple of my bugs ”You guyz killed couple of my bugs.

- TestFuzzer August 16 2011TestFuzzer, August 16, 2011

Lessons learned

Bugs were spread across the entire code base

Eliminated some low hanging fruit

1 code change per 12,600 CPU hours (1.44 years)

Using fuzzing as hints

1 good dev == CPU years of fuzzing effort

Fuzzing can provide hints of where to focus code review.review.

F d l th th b fi i Focus on code cleanup rather than bug fixing.

And, of course…

There is always one more to find…

Integrating security defenses

Holistic mitagations

Work smarter, not harder.

More effective at deterring attacks

Require experienced resources

Require longer periods of development time.q g p p

Standard White Background Bullet Slide

JavaScript blacklist Improved updaterImproved updater Reader X Sandbox

Dedicated team for over 1 year of effort Dedicated team for over 1 year of effort Additional engineers for misc. support External consultants

Cause and effect

Reader JavaScript blacklist introduced

PDF O l tt kPDF-Only attack

PDF w/ SWF attack

PDF attacks switch from JS to SWF

Effect of sandboxing

Reader X sandbox launched

CVE-2009-1862

CVE-2010-3654

CVE-2011-0611

CVE-2010-1297

CVE-2011-0609

CVE-2011-0627

Sandboxing in Flash Player

Currently sandboxed in Chrome Firefox currently in betaFirefox currently in beta Researching:

Chrome pepper sandbox Chrome pepper sandbox IE improvements

Other minor improvements

Safe unlinking in garbage collection Random function alignmentRandom function alignment Random NOP insertion

Constant folding* Constant folding*

Other minor improvements

Safe unlinking in garbage collection Random function alignmentRandom function alignment Random NOP insertion

Constant folding* Constant folding*

Updating end-users

Update Goals

Work with AV and IDS vendors to create accurate signatures that will protect end-users until they get the patch (MAPP)

Reduce the time to update the majority of end-users to minimize the window of opportunity for the exploit

We have a background updater!!

New updater will allow us to do silent updates for zero-day patches

Updates both IE and open-source browsers

Complete technical details will be posted with the launch!

Handling response

Incident response strategies

Be prepared to triage duplicates, triplicates, quadruplicates, etc….

Set a response timeline goal Have a regular update scheduleHave a regular update schedule Be willing to shift launch dates

A d h t l And have tools….

Adobe SWF Investigator

Open-source AIR application View SWF tags, disassembly and binaryView SWF tags, disassembly and binary Test AMF services and check for XSS

Inspect LSOs and settings files Inspect LSOs and settings files Execute the SWF in various contexts

Available TODAY!!!!!

Summary

Advanced Persistent Response

Understand your threats

Advanced, holisitic security features are needed to ward off future threats

Need to utilize both internal and external resources to accomplish goals

Start early because the best defenses require time to develop

Looking ahead

Mac auto-updater

Improved IE Sandboxing

Yet more fuzzing

References

Security portal: (customer & channel partners) http://adobe.com/security

Advisories and updates: http://www.adobe.com/support/security/

ASSET blog: http://blogs.adobe.com/asset

Adobe Security on Twitter: @AdobeSecurity

PSIRT blog: http://blogs.adobe.com/psirt

Documentation Wiki: http://learn.adobe.com/wiki/display/security/Home

Adobe Security on Twitter: @AdobeSecurity

Peleus Uhley on Twitter: @PeleusUhley

Advanced Persistent Response - Pwn2Own › csw12 › CSW2012-AdvPersistent... · Advanced...

Documents

Transcript of Advanced Persistent Response - Pwn2Own › csw12 › CSW2012-AdvPersistent... · Advanced...

Persistent 2QFY2013RU

Advanced Persistent Threats · Advanced Persistent Threats Evaluating Effective Responses strategies for organizations and their impact ... –Examine why Advanced Persistent Threats

An Efﬁcient, Energy Stable Scheme for the Cahn-Hilliard ...shen7/pub/CSW12.pdfProof. Forbrevity,weomittheproofforthe uniquesolvability here,butrefertothe proof in Section 2 for the

Persistent Diarrhea

Persistent Objects

Persistent Sebi

CSW12 Initiation Kit

Integrated System Registration, presence (SIP) persistent chat (XCCOS) Registration, presence (SIP) persistent chat (XCCOS) Lync persistent chat pool.

Biomonitoring of Non-Persistent and Persistent Pesticides and...Biomonitoring Persistent and Non-persistent Chemicals in Human Breast Milk . and Endocrine Disruption of Lactation .

Persistent Pulmonary Hypertension of the newborn (PPHN) Persistent … 15 Wung... · 2016-06-27 · Persistent Pulmonary Hypertension of the newborn (PPHN) Persistent Fetal Circulation

Persistent Memory in Operation - suse.com · Persistent Memory in Operation

Persistent Prayer

The UKs persistent organics pollutants multimedia · The UK’s Persistent Organics Pollutants ... 8th Network Conference on Persistent Organic Pollutants Framework and obligations

Persistent Systems

Persistent Pain

Persistent Faith

FOOD SCIENCE AND TECHNOLOGY - senior … · ... and enhances emplo yability and career ... food and beverage manufacturing, food processing, community ... palatability, digestibility

McCoy, Reed, Guernsey [csw12]

Advanced Persistent Advanced Persistent Threat … Persistent Advanced Persistent Threat (APT) Threat (APT) Lethal Combination of Social Engineering and Technology June 6 th, 2011

Introduction to GISIntroduction to GIS of GIS.pdf · y70% of the information includes some geographical facts in the decisiongeographical facts in the decision-making process yAbility